ci: set permissions for GitHub actions

[neilnaveen]

• Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

Signed-off-by: neilnaveen 42328488+neilnaveen@users.noreply.github.com

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

[MarlonGamez]

@neilnaveen this definitely seems like a good change, should we do this on all of our jobs? Or is this only applicable to the one job that you modified?

[MarlonGamez]

@neilnaveen this definitely seems like a good change, should we do this on all of our jobs? Or is this only applicable to the one job that you modified?

[neilnaveen]

@neilnaveen this definitely seems like a good change, should we do this on all of our jobs? Or is this only applicable to the one job that you modified?

Probably yes, for now I was able to address this one. Thanks

[briandealwis]

Thanks @neilnaveen for picking this up.

@MarlonGamez The other jobs have permissions: read-all.

[briandealwis]

@neilnaveen you'll need to sign the CLA

[codecov]

Codecov Report

Merging #7291 (1ab611f) into main (290280e) will decrease coverage by 1.99%.
The diff coverage is 56.96%.

@@            Coverage Diff             @@
##             main    #7291      +/-   ##
==========================================
- Coverage   70.48%   68.49%   -2.00%     
==========================================
  Files         515      560      +45     
  Lines       23150    26507    +3357     
==========================================
+ Hits        16317    18155    +1838     
- Misses       5776     7096    +1320     
- Partials     1057     1256     +199     

Impacted Files	Coverage Δ
cmd/skaffold/app/cmd/deploy.go	52.00% <ø> (-1.85%)	⬇️
cmd/skaffold/app/cmd/dev.go	84.61% <0.00%> (ø)
cmd/skaffold/app/cmd/render.go	36.66% <0.00%> (-4.72%)	⬇️
cmd/skaffold/skaffold.go	0.00% <0.00%> (ø)
cmd/skaffold/app/cmd/inspect_tests.go	62.50% <14.28%> (-1.14%)	⬇️
cmd/skaffold/app/cmd/lsp.go	28.12% <28.12%> (ø)
cmd/skaffold/app/cmd/fix.go	68.85% <40.00%> (-7.62%)	⬇️
cmd/skaffold/app/cmd/lint.go	42.85% <42.85%> (ø)
cmd/skaffold/app/cmd/find_configs.go	48.88% <50.00%> (+0.24%)	⬆️
cmd/skaffold/app/skaffold.go	76.19% <70.00%> (-8.43%)	⬇️
... and 227 more

📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more